chore(docker): use npm ci instead of npm install in frontend Dockerfile

npm ci installs exact versions from package-lock.json with no implicit
resolution, making builds fully reproducible and guaranteed to use the
audited safe dependency versions.

frontend/Dockerfile

@@ -6,8 +6,8 @@ WORKDIR /app
 # Copy package files
 COPY package*.json ./
 
-# Install dependencies
+# Install dependencies — use ci for reproducible installs (exact lock file versions)
-RUN npm install
+RUN npm ci
 
 # Copy source code
 COPY . .
@@ -25,7 +25,7 @@ FROM node:20-alpine AS build
 WORKDIR /app
 
 COPY package*.json ./
-RUN npm install
+RUN npm ci
 
 COPY . .
 RUN npm run build